K000137053 : Overview of F5 vulnerabilities (October 2023)

Security Advisory Description

Note: F5 is committed to responding quickly to potential vulnerabilities in F5 products. As with all publicly known vulnerabilities, F5 is committed to publishing a response as soon as the vulnerability has been thoroughly investigated. In this case, an external researcher informed F5 that their findings would be made public on October 10. To reduce the impact on our customers, we made the decision to move the October 18 QSN to October 10 to mitigate the disruption caused by multiple disclosures.

On October 10, 2023, F5 announced the following security issues. This document is intended to serve as an overview of these vulnerabilities and security exposures to help determine the impact to your F5 devices. You can find the details of each issue in the associated articles.

You can watch the October 2023 Quarterly Security Notification briefing by DevCentral in the following video:

• High CVEs
• Medium CVEs
• Security Exposures

High CVEs

1F5 evaluates only software versions that have not yet reached the End of Technical Support (EoTS) phase of their lifecycle.

2F5 has fixed this issue in an engineering hotfix that is available for versions of the BIG-IP system which have not yet reached End of Software Development. Customers affected by this issue can download the engineering hotfix from the MyF5 Downloads page. For more information, refer to K000090258: Download F5 products from MyF5. While F5 endeavors to release the most stable code possible, engineering hotfixes do not undergo the extensive QA assessment of scheduled software releases. F5 offers engineering hotfixes with no warranty or guarantee of usability. For more information about the hotfix policy, refer to K4918: Overview of the F5 critical issue hotfix policy.

Medium CVEs

1F5 evaluates only software versions that have not yet reached the End of Technical Support (EoTS) phase of their lifecycle.

2F5 has fixed this issue in an engineering hotfix that is available for versions of the BIG-IQ system which have not yet reached End of Software Development. Customers affected by this issue can download the engineering hotfix from the MyF5 Downloads page. For more information, refer to K000090258: Download F5 products from MyF5. While F5 endeavors to release the most stable code possible, engineering hotfixes do not undergo the extensive QA assessment of scheduled software releases. F5 offers engineering hotfixes with no warranty or guarantee of usability. For more information about the hotfix policy, refer to K4918: Overview of the F5 critical issue hotfix policy.

Security Exposures

K75431121: BIG-IP APM OAuth Bearer with SSO does not process HTTP headers as expected

| BIG-IP (APM)| 16.1.0 - 16.1.3
15.1.0 - 15.1.8
14.1.0 - 14.1.5| 17.1.0
16.1.4
15.1.9

K21800102: HTTP RFC enforcement is bypassed when a redirect iRule is applied to the virtual server

| BIG-IP (all modules)| 16.1.0 - 16.1.3
15.1.0 - 15.1.8
14.1.0 - 14.1.5
13.1.0 - 13.1.5| 17.1.0
16.1.4
15.1.9

K000135944: Attack signature check security exposure

| BIG-IP (Advanced WAF/ASM)| 16.1.0 - 16.1.3
15.1.0 - 15.1.8
14.1.0 - 14.1.5
13.1.0 - 13.1.5| 17.1.0
16.1.4
15.1.9
NGINX App Protect WAF| 4.0.0 - 4.1.0
3.3.0 - 3.12.2| 4.2.0

1F5 evaluates only software versions that have not yet reached the End of Technical Support (EoTS) phase of their lifecycle.